CVE-2026-2141: WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
Vulnerability summary
CVE-2026-2141 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in 5kcrm wukong_crm. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 08-02-2026PublishedVulnerability first disclosed.
- 23-02-2026Last modifiedVulnerability information updated.
Description
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RDiffers
- NVDNIST6.5MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 0.39% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSourbyte Lab
Maturity: poc
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
5kcrm1 product
- wukong_crm≥ 11.0, ≤ 11.3.3
Wukongopensource1 product
- wukongcrm11.3.0 | 11.3.1 | 11.3.2 | 11.3.3
2 vendors · 2 products